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• Statement:, of the Problem 

^ In recent year^ the amount of - education relatecf research" has 

! ■ ■ . - ^ • . 

grown at an unpreced-ertted rate. It can btf said that in the educatiotial 
worlV..Q5;^,:fetre' 196.0 's a knowleclge explosion occurred and will undoubtedly 
continue through the 1970*s'and beyond. Prominent in this influx of 
knowledge haa been the application of systems technology and systems 
analysis to aid in the solving of educational problems.. 

Analysis. of a System, in relation to accomplishment of previously 
established objectives can.be viev;ed in term^^f ^wo basic approaches: 
(1) anal^ysis in terras of success or accomplishment of a syatem's . 

purpose-r-t'hat is, what must^or should be don^in order to achieve 

■ ■ - ■* 

desired results.; or (2) analysis in terms of failure or non-accomplish- 
ment of a. system's purpose. Although failure prevention is becoming 
increasingly important^ the -general procedure- of both the past and 



present seems to be to look at* success factors . Yet, it seems much 
more difficult and ^ time consyning to predict or determine v/hat 



\ 

promotes success in a system than it does ^o isolate those factors 
which cause failure.^ Furthermore, among a panel of experts in any ^ 
specified systeJi, it' generally is easier to achievQ consensus as to 
what constitutes failure :j^n a system than vrhat cqnstitutes success. 
Ifence, in the f i^ld of education Jt decision mak^^^can systematxLcally 
-isolate fai;ture modes .within a system,"'the probability- for succps will 
be enhanced. " The problem is to explore atid suggest a systematic 



appro'ach to analysis of fact^^rs c^ontrfbuting to failure for the purpose 



Purpose of Stud 




The purpose of this study is to introduce ctJe concept of Fault 
Tree Analysis as a systems, tool and to determine the implications 
of Fault Tjree Analysis as a technique for isolating failure modes 
in educational systems. Specific ol)jectives include: ^ 

.1* To define Fault i^Tree Analysis and discuss its histooy as it 
relates to the systems apj>roach. 

2. To describe the step by step ptocess for Implementation and 
» y . use of Fault Tree Analysis. 

3. To identify what is presently being done in the United 
States with Fault Tree Analysis as it applies ^to education. 

^4. To present a Fault Tree prototype to suggest solutions to 
a problem in private education. ' ,^ • 

The purpose of this repoijt, then, is to discuss-and present to 
educators some background in Fault Tree Analysis a<^ applied to 
educational planning, evaAiation, and' problem^ solving, together with ^ 
an explanati^Dn of the present use of Fault Tree Analysis in education - 
and an example of the technique as applied to a problem pertinent to 
private education. . . . . 



{ 



. . , ■ ■ ; ■ r 

o Definition of Fault Tree Analysis 

FaCilt Tree^^ Analysis (FTA) is an 'operations research technique 
which has been used with -success as th'e principle analytical tool of 
systems .safe'ty engineering on aerofepacc projects. As -used in the 
aerospace industry, Ppv;ejs (1974) states, that I|^ult Tree Analysis 
refers to -event sqliences which lead up to a. significant predefined 
failure such as loss of mission where ther^exists potential for 
injury of personnel cynd /or 'large ecdjiomic losses. Crosseti (1971, 
p. 53). adds: 

Faul^ tree analysis/ proj^ides a functional development of a 
/specific' final undesi,^^ event through the logic statements 

of the conditions which could cause the event. Once the final 
* event is defined for* assessing sysLtem performance, this mathod 
provides a concise and orderly description of the various Jcgmbina- 
tions of possible pccunrences within the system, that^ co^xi result 
in the predefined evenl^ 
, /. 

As used in aerospace a^d other scientif ic disciplines which ' involve 
hardware systeths, Power^s''^^(197'4) further defines Fault Tree Analysis 
by indicating th^t itvis a. graphic representation olE ' the logic which 
^dciscribS^ information f low * (in ^this carse failure propogat ion)' in the 
processing natwork- . Tic says that the basic building blocks of the fault 



tree are comoosed of the logical interconnections among event Sequences, 
known" as logic gates. A logic gate def ines ^he inpi*t conditions, which 
must bfe* present in order for a failure sequence to move or propogabe 
up tfte tree. There are two basic logic gates: the ^'and*' gijte, and the 
"or'* gate. Both vzill be discussed in "depth later in this pape#.. 



R^cht (1965) defines FTA as a method of analysis in which an 
undesired ev/ent is. selected and all tlvt po.Cislble happentpc;3 tHat can 
contribute tg t\e event ai:e di^granraed in .the form of\^_^ree. The 
branches of the tree are 'continued outward and do\^ward from the 
undesired event until independent events are reached. ^Probabilities 
can be determined for the independent events, and both the probability 
of the undesired event and the most iikely ^hain of events leading up 
to it can be computed. ' ' ' 

* Fault Tree Analysis differs little in definition among disciplines 
or between "har-dvzare*' and "hum^in" systems.- As it related to human 
systems — speciffLcally to education-- Stephens (1973, 1974, 1976) has given 
the mpst concise definition. He says that FTA is a technique for 
increasing' the probabllijiy of success in any system by" analyzing the most 
likely nodes of failure which could occur within the system and. then 
suggesting hig^i priority avoidance strategies for those failure modes. 

A fault tree (spmetimes referred to as an "event logic network") provides 

. ■ ■ ' . ' . ' " * / ■ ■ ! . . • 

a concise and logical step-by-step description of the various cpm'|>ina- 

tions of potential possible occurrences within a systfem which^ could 

result in the failure of the sy3tem.' It is a graphic protrayal or 

• ' * ■ ' ^ ■ i • 

diagram which systfcmatically^jdepict^ the probable f^ailure event ! 

sequences and the interafctions among these sequeijces x^hich can lead to 

failure of a top, undesired event. The objective ±d to identify and ^ 

isolate possible failure r|odes and thereby avoid them. 

In 1973 (p. 3) S-tephens wrote: 

The process of 'fault free construction starts with a 
statement of a critical undesired event which one xjants to 
prevent from happening. The fa\^t tree is then constructed 



according to a scries of logic steps, showing precisely »how / 
a given failure [failure as here used means the inability of a/ 
^y.^,tcii: or a nortion of a systo/n tr.c pr.rfvorrn its expected ' I 
f uliction(j) ] €:V^at couiJ cuicur. V;hcn the tree Is finished, 
Ttiathemtical f ormul^^s ' are [can] be applied to determine tua 
strategic paths leading to the top (most general) undesired 
event. On large trees the data can be fed into a computer 
for simulation and quantification. ^ ^ 

The value of' finding the critical or strategic failure path 

throu'^h FTA is that it provides a clear indication to the decision 

maker (s) as to the weakest link in the system and thereby provides 

information for setting priorities in the decision making process 

(Witkin, 197 IX . ^ - . 

The name "Fault Tree Analysis" is derived in the fact that the 
graphic portrayal o/ a functional system which has undergone the 
process of Fault Tree Analysis utili?*es a branching pro^cess similar 
in' outline to a coniferous tree (Stephens, 1971). 

To conclude, the fault tree method of analysis takes the approach 
of looking ,at^ anci analyzing the most undesirable events which could 

occur yithin a-system and then searching for and analyzing failures 

■ . ' \ ■ • , 

in sequence which cdi^ld lead to these undesirable events . 

History of Fault Tree Analysis 

The development of FTA is an outgrowth of tjie systems safety 
approach (Recth, 1965) initiated in ^the space industry in the late^ 
1950*s and early 1960's. Fault. Tree Analysis provided an added . 
dimension. to the systems safety approaciji by introducing the concept 
-of failure prevention. A full appreciation and understanding of the 
history of FTA requires th^ necessity to view FTA in the context 




of systems safety a&alysis. Recht (1965, p. 38) recounts the, 
orif;uis of system 5a£c*<':y ^'Si-'.s : ' - 

The history of syr.tcms saCety analysis really he^J^an in 
the aerospace iodJiStry. It was the result of the extreraely 
high reliability and safety specifications demanded by the 
space and military requirements and th^ fact that the time 
honored production sequence was no longer practical • 
C , , ^ . - ■ 

For example, until recently when a new aircraft was 
developed, it was first designed, then an experimental model 
was built, and finally it 'v;as test fro\>m to determine its 
capabilities and flaws; the information obtained indicated 
the necessary design changes and the cycle was repeated Q; 
until the performance specifications were me^t. Today's- ' 
aircraft and missies are so complex and costly and the 
specifications are set so high that this procedure had to 
be changed. Moreover, missile flight tests involve loss of 
tjie model vrith only limited telenietry data obtained. Today 
the "bugs'* must be found and corrected as far as possible 
in the design stagjfe using analytical technique. 

The result is the development of the svstems approach 
* to safety. The aircraft or missile is examined from this 

point of vievz and the effects of any failure or malfunctions 
on the operation of aircraft are , evaluated to determine 

the principle desigt)/def ects which need to be fixed. For 
these complex systems sophisticated analytical methods 
have been developed... . Thus the test pilot has been 
replaced by a systems safety engineer... . 

Fault Tree Aniilysis has it$ beginnings in the above described 

setting. Fussell, et al. (1974, p. 51) relates: ^ 

In 1961 the concept: of fault tree analysis was or^-ginated 
by H. A. Watson of Bell Telephone Laboratories to evaluate 
the safety of the Minut^man Launch Control System. The 
technique was further developed and refined' by a Bell Telephone 
Laboratories study team. 

i 

Engineers at Bell Laboratories discovered tViat the method used 
to explain the flow, of "correct" logic i-n data processing equipment 

■■ ' ■ i 

could similarily be used for analyzing the "false" logic resulting 



from compon'fent failures (Witkin and 



Stephens, 1968)- A team of 



analyst Q at the Boeing Company later modified the technique so that 



the quantification (prioritizing and determining the probability of • 

occurrvincc ol failure evctaLs) of the .LaalL Lvoe could /ue ^accu*npli''^^ned 
■„ 

via. a "digital computer (Fiissell, et al., 1974), ' 

Although the .concept of FTA is of recent origin (1961), the 

■ ' -* ^ 
idea of looking for brealcdo^^s in a system is not entirely new. Other 

techniques such as the Critical Incident Technique*^ Cause and Effect 

Analysis, etc. bear a superficial resembl^a^e to Fault Tree Analysis. 

For a description of these techniques see Stephens, 1972. ^ 

History of Fault Tree Analysis ' « 

as related to. education 

Until 1967, few attempts had been made to apply the concept of 

FTA entirely to human systems, chiefly because analysts trained in the 

technique were mainly engineers concerned with systems safety without 

a "feel'* for behavorial systems, and partly because no adequate method 

of defining strategic paths (the most 'critical sequence of failure^ events) 

had been demonstrated in behavorial systems* (Stephens, 1973). 

The first full scale application of FTA to educational planning 

and evaluation was that done by Witkin and Stephens (1971) iri"1967-68 

under th€ auspices of the Alameda County PACE (acronym for Projects to 

Advance C^reativity in Mucation) Center, Hayward , California- This 

initial application of FTA to education was in the interest of 

discovering a predictive tool which would act as a sort of "early 

warning" signal to educators concerning critical needs-, to which they. 

should direct their attention. 

k Regarding this first use of FTA as it applies t^ education;, Witki'n 

-writes (Witkin and Stephens, 1968, p. 7); < - 



In'^tKe fall of 1966, the researcVi specialist of the 
' [Alameda County PACE] Center was put in touch with Kent , 
Stcphflns^ than a' mrrabar of -an acii*cr>pace p.rcuip in* the Boairfj; 
Corny viny, and iirst learned about* faUlt tree analysis.' ^ • 
* . Subsequently, Stephe;ns and two collogues, Dclvid^ llaasl and • 

Jon* Stephens, visited thre .PACE Center to explain the principles ^ • 
- of f^urt tree , analysis, and in May 1967 they conducted a week- 
^ long training, program £or school administrators and other ^ . 
inter ested* persons uitdar the sponsorship of the [PACE] Center 
and the Alameda County- School Department. There, the first trees 
applied -to education^al problems/^were drawn and the possibilities 
^ of the^ technique were 'explored. V 

6r.;K$nt G. Stephens was .a member of the|Boeing team which modified 

the fault^'tree technique in rielation to the Vuantification t>f failure 



events,- enabling it to be accomplished with a digital computer 
(Witkins and Stephens, 1968), and Wood (197^, p. 2) has identified 
Stephens as *\ . . the father of the quantification and application of 
Fault Tree Analysis to education.^' ' Dr. Stephen^ is currently an 
Associate Professor in Education at Br i^hara Young University, Provoj . 

* . ■ V ■ ^' ' " ■ • . ■ 

Utah. . . 

Fault Tree Symbols and Definitions . 

In this section the basic symbols of Fault Tree Analysis are 
presented -ani defined and the concept of logic gates is clarified. 



Logic gates . ^ - ^ 

The fault tree is constructed by showing the relationship between 

.various kinds of events which could cause failure of the system. 
These relationships are symbolized by logic gat&i^ The concept of aogi< 
gates is the heart of the fault tree technology and they are the factor 
which causes it. to differ from other forms of analysis. Stephens 

' (1973, 1974, 1976) has described the concept of logic gates extensively 



I: 



4^ 



and indicates that two principle Rinds of logic gates exist\ the AND 
j:;ate and the OR gate. All other gates used in FTA are derivatives 
of tt^ese two types, j , * 

Graphically,, the AN1> gate is depicted , by /the syjmbal 
and is used \vfien two or more events must coe:;ist in order . to produce' 
the more .general event. Figure 1 depicts the p9rtrayal of event3 
related by an AND gate as they would, appear in a fault tree. 






Figure 1. The AND gate, > 

this tree would be read; Events B and C must coexist in order to 
produce Event A; or, the output A can occur only if the inputs B and C 
coexist • The mathematical equivalent of this is A = (BAG). 



10. 



The use of the AND gate(s) occurs much less- frequently (in some 
cases not at all) in b.ehavorial 5^yr,teTiis than in, hardwafp. syr.f^is. 
' * The OR iogtrr^atp. occurs most commonly in behavorial systetns. 
It is used/ when, of two or more possible inputs to an evfent, an^. one 
alone could produce ^the output. The OR gate is depicted graphically 

by tt5'symbo\ ^^^^ • ^'isure 2 depicts the portrayal. 'of -fev en ts 

related by an OR gate' as they Vould appear in a fault tree. <, > 




r 



V 



- 










c 



Figure 2. The OR.gate. 
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The tree depicted .in Figure 2 would be r^ad : blither B; or C 
events alone ^wlll produce Event A, TTio iT>at:hep:?.<:xca]. equivalent of this 
is A ^ (B C). , • '* s ^ 

Stephens (1976)' notes .two general kinds of OR gates — ^tha 
inclusive;. OR depicts the situation in which either Ev^nt B or C or 
both could result in Event A. The EXCLUSIVE OR situation differs 
in that either Event B or C could produce Event A, but-bcjth B and C 
could not 6ccur at the same tiine. It- should be noted th4t with- 
either the AND gate or the OR gajte logic, more ;^aa/^Ewo inputs may 
exist to any event, however, it is alxv-ays necessary to; have at least 
two inputs. . , 

■ // ' -" ■ ■ •■ ' ...... 

Basic fault, triee symbols • - 

Besides logic gates, the other set of symbols used in FTA 
depict ,the types of inputs and outputs or events. Events, whether 
they be inputs or outputs, are classed according to their nature., 
Stephens (1973, 19-74, 1976) suggests the following symbols as thosQ 
most commonly used for fault trees: • . 

' 1/. Rectangle: Identifies an event that tesults 




from a combination of less general fault events through. an associated 
logic gate J All events symbolized by rectangles have additi^ott^l 
development or analysis in the faiiit tree. ' - ' ^ ^' ' 




Circle : \ / . Identif ie^^ basicr, failuiSievjenS in which 

no further 'development is requtr^di^ The ;deciiSiou^e2arding whether the 



event i/s ayasiq oiie or not^ depends largely on the perspective ^ 
of the analysis, /rtasic "failure event oce^urs vKen- the, def irtition of 
aru event Is .sufficiently explicit to satisfy U:h(^ purpose of the • *• 



analysis. It is a f ailure'intlerent \ri.thin the unit of analy^ig* 



}. Rhombus: 




IdenriiEies an event^ which^'is 



not developed further becad^ Qf <aj! insufficient info^CHi^tion., 
\h) vfery remote, likelihood of oWcurrenQe, or >((^^ due to otsher 
constraints (eg/ t^me, monej, etc.') which preclude iUrther an^ysis. 
If dt'a later date, however, constfraints wee removed and it is 

of * ■ *^ . ■ 

desired to "analyze the rhombus in greater depth, then it can b.e 

Changed to a rectingle* in vzhich case it co^ld be developed and., , 

analirzed further ^Stephens, 1973).- The rhombus has no 'relationship 

with the diamond used as a decision point in flow charting. 

^ J 



4. Housip,: 



Identifies an event which, under normal 



conditions, is fexpected to • occur in the system defined and by itself 
may not cause a failure event 1 , The importance of noting -it , hpwever, , 
is that when combined with other-events it might contribute tola 
failure event. 



These provide the basic symbols used in fault tree analysis and , 
' ' ' ■ ■: ^ '■ \ 

construction. A few other symbols and definitions have been id^ntifiied 

by Stephens (1.973) and appear in the appendix of this paper. ^ 

The symbols reviewed, displayed in Figure 3, a. rudimentary fault. 

tree branch which is read' as follows: "Event A can be produced either 

by"' Event B or Event- &-or both. Event B can be produced only by the 



coexistence of Event^s D and E, Event C can be produced either by 
Evpn,t ¥ or'Ev-nt C or hoth/* (Sti^phens , . 1973 , p. 10; 19^, p. 6; • ' ' 

' ■ ■ ' ^ - ' • r - " \ 

1976, pp. 7«-8) Ev(int E is viewed as 'a primary of a l^asfLc failure event 
'ah^ Event P is an event which is, normally expected to occur within the 

system, but vhich can contribute to Event C, Events D, E, F, '^an^ G~at 

• * '■ • •*. ■ » ' 

the^bottom of tlie tree — -require no .further ajtalysis q]^ 'developments 



^ i • 





Figured, Illustration of a fault' tree branch 



. The bottom of the tree for any fault tree branch 4iould always 
have eyt^ts depicted byr the cirtfle, rliom>?us , or house; These signify * 
the' end of developmajit . In the exampl^i port;:a^uad-^^ 
'are two branches of • th^ *tree an<J. three levels of .deV^iopment- or [ 
analysis,-, ' • \ . < . * . v -4 

y:'-^ . • . -k' ^ ' .-. . " ■ 

^ Steos in Faa3rt-Xa;ee Constr uction 

*' . ■ -S : I. , * 

It must be rememberred that the f,ault tire^ 'metho^i^ was init^ially' - 
developed tor ^use* in hardware systems, ^ Although^relatively 'aifctle 

i > /• " - / ' ' r ■ v'r, 

has been published on the concept, a fevz scattered articles .e^^plaining. 
the procedures for conducting a Fault Tree Analysis have appeared 
among jeveral disciplined (see Powers^, 1974; Eisner, 1972; j/seXv,- 
1970; Evans, 1974;, Fussell, et al, , 1^74^ro^ssitti, 1971) / Although 
^similar, procedures vary somewhat among authors arul between 
'disciplines. Since the purpo^e^of this paper is to explorte Fault Tree 
Analyses in^^ah educational context, references- to technique ^nd 
methodology v/ill be tafcen chiefly from Stephens who has plonked ' the- 
concept in edueat?±oV0>^ood> 1975) aitd behavojrial systems. In 196> 
Witkin and Stephens wrote that the p .nciples of. Jault Tree Analysis, 
as they applied to education, were undergoing f urthe'i:^desrel5ipjnent 
and- wfere subject to change." Hence, in considering the general steps 
in fault tree construe ti,on and, analysis, care v/ill be/ taken tg cite th 
most current references available. ' . ^ 

The present state of the art identifies the foll6wing as general 
stepd'in Fault Tree Analysis' (Stephens, Cla^s Lecture, October 28, 
1975): • . ; 



/ 



1. SySftems definition 

3. Ident-lf ication of ^undesirad eveiits 
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J 4. Fault hazard an41ysis " ' :^ , " • 

: . . . , ' ' - ■ - 

. * ^'5. Oualltalive\. fault tree construction ■ r 

. ' ' . ■ ^ ■ . • 

6. Qj^antitative evaluation . ^ 

(7. Pormulat^g "Vecommendatj-ons ■ ^ , . 

- ^\ ' . . • ^ / ,. 

Systems flef initit)*n 1 - ^: 

Systems definition essentially, entails formulating the exact 
problem to bV^^nilyzed.v - Systems def inition should* specif ically stata?*^ 
the goals and /or objectives of the system to be analyzed, IThen 

■ , , \-. ■ : ■ ,•■ ■ 

properly * stated these goals and/or objectives become known as the 
mission statement. The mission statement should include a4i explana- 
tion of the system restraints and a recognition of the system bounds. 
Bounds are those factors over which there is no control and restraints 
' identify factors over which there exists some control (Stephens, Class 
Lecture, October 28, 1975). ' '■ 

Mission analysis ^ 

kiBS^.on analysis includes the mission gtatement---that is, vrhat 
is to be accomplished, and it identifies the specific performance 

rj^q^rements of criteria nec'fessary.in oVder to successfully complete 

» ... ^ ' ■ 

the mission within the bounds ^nd constraints set i^n the systeius 
definition. It is a statement of the missiorf along, with the required 
functions and tasks necessary to complete the miss^n (Witkin^ 1971)- 



20 



/ ' ■ "V ■ ■ ' ' * ■ ' ' • 

The'^mission analysis is derived by ^systematically considering 
' — J >* 
the iraj.or functions nec^ssiary to acconipllsli tlia ni.fision nr.d uhose . 

■ * -^ft - • " • • 

impor't^int t^^sks \^hic;h must be accomplished vjithin e^ich function. f r 

Stephens (1972) statfes that two steps are present in perforrning a 

mrsslon' analysis: (1) The first step is to list the major functio'ns 

that will be needed to accomplisl> the mission statement given 

•c ■■ • i - ' , • • 

previously in the systems def initionr This is referred' to 
function analysis, and provides ^n answer to th«^^uestiioT>, "Wha.t' ^ - 
^are the^ major function's ne'eded to accomplish thetigiiss^-On or goal 
statement.?" (2) The ^econd step in performing a mission analysis 



is to consider the major tasks which must be accomplished within 

• ■ • ■ 

each function and is referred to as task analysis. TWe process, 

as here described, is illustrated in Figure 4 (Stephens, 1972, p. 25) 



Step 2.0. • , ; • , ■ Step 2.1 ' step 2.2 

Statement of Lifting of ' , . Listing of 

goali purpose ^-E^inctions " ' ^ .tasks needed 

or intent^ , needed to , to accomplish 

^ accomplish each function 

' mission 

V • ■ ■ ■ . 

^Figure 4. Schematic showing major steps in mission analysis . 



The performance of a mission analysis permits, the performance of • 

6 



function and task atialysis. They, in turn', greatly facilitate 
Fault Trfee Analysis during qualitative fault tree construction 
because they allow the identification of s/ecif i^c railure events 
more readily and effectively than with simply an examination of 
missions and major functions (Stephens, 1972). In short, mission 
analysis enables the analyst (s) to see the system under study in 
abroad perspective and to identify specific prbblem areas for" 
later analysis. . 

• • • ' ■ \ " ■ ' ■ 
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Identification of \ * ' 

unjleslrea events ^ 

* ^ Based 0:1 the ui.ssion or g^ais SLatctiuuic oi the syst.ems defiaitloii 
and the mission analysis, the akalystNor team of experts 'conducting 
a FTA would list those events which they do not want to .happen relative 

r ' . 

to thd' system under investigation/ These events should be written 



in' terms "of failure and are the me^ns^^ identifying the major 
undesired events which could od'cur l^n the system. 




Itainay appear that selection oF^ the major undesirfed events 

based on the mission analysis, and- in\ fact the 'entire analysis for 

- ' " ■ \ 

""failure in the fault tree process is simply the logical reciprocal 
of analyses fot success. To a degree this is true, ho.^ever, experience. 

has shoTO (Stephens, 1976) that failure; tinalysis giveis added perspectives 

- \ 

on a system which is far beyond the noti^on chat analysis for failure 

\ ■ ■ • ■ ■ 

is merely, the logical inversion of analy.^is for success. 



By examining failure mod^s, the faul^t tree process generates 
questions ^bout a system v/hich would not occur under th6 usual 
conditions of success analysis. Furthermore, analysis J^r failure . 
is generally much more conducive to consensus formation Lamqng a. group 
of experts than is analysis for success. It appears* easier to come 
to agreement on what not to do, than tc( consider and attempt to agree 
on the many facets of what should be done* 

Fault Hazard Analysis 

,^_^^^nc'e the major undesired events have been identified they are 
^ranked in relation to each other-, in order to determine the highest 
priority undesired event. There is no hard sot rule as to how the 
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ranking can or should be accomplished* This determination and selection 

ol *:ha hi^hiiSt prioclty undcis.lrea eveat 13 t'-rr-'/rifi Fault llcziird^y^ 
Analysis (Stephens, Slass Lecture,- October 28, 1975)* ^ — 



Qualitative fault tree construction . * 

— ^ . 

* Qualitative fault' tree construction begins after the selection of 
^a top or most general undesired event. Fault-: tree construction' is y 
generally the most tedious and j:he most critical aspect of Fault 
Tree -^r^alysis, for kt this point the: analyst begins sketching or drawing 
the fault tree* It should be remembered that the fault. tree consists 



of events, interrelated by logic gates, resulting in , sequential pathways 
of potential failure* Analysis begins with^ the precise statement of 
a predefined undesired event (UE) of critical importance. An example 
may be failure of the entire system expressed in terms of failure of' 
the mission, or it may be a failure identified with some function or 
task crucial to the success of the mission. Regardless, it stands 
at the top of the tree, and analysis proceeds doraward and outward. . 
Inputs to the UE in turn become contributing failure events in a 
perceived cause and effect relationship (Stephens, 1976)* The purpose 
now is to determine the possible modes of occurrence of the UE* 

In drawing the fault tree, the analyst should have a good working 
knowledge of 'the system under analysis, or immediate access to experts 
who do'. 

• • .-J ■ . ^ 

Scoping the tree . After selection of the UE, the initial phase 
and general format of ^qualitative fault tree construction is to look 
closely at the mission analysis as depicted in Figure 4 and convert it 
into a graphic fault tree* (Figure 5 portrays the mission analysis 
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cpaver ted into the form of a fault tree. This process is called 
/'scopins the tree/' (Stephens, Civics Lecture, NoveTTiber 11, 197 5) and 
is the basis of additional development and accurate analysis. The 
scoping of the tree generally results in three distinct . levels o£— 
development (mission, function, task). Stephens (GTLass Lecture, 
November 11, 1975) has stated, "The first three levels of the tree 

' \ / - ■ ■ ' ; .. 

are usually the policy levels.!' . 



UE 



FAILURE OF 
HISSION 



ETC. 



FAILURE OF MISSION 
BECAUSE OF FAILURES 
RELATED TO FUNGTDN 
A / 



Al 



FAILURE OF MISSIOII 
BECAUSE OF- FAILURES ■ 
RELATED TO FICTiIn 



FAILURE OF MISSION 
BECAUSE,OF FAILURE 
meu'to FUNCTIOH 



ETC.„— . 



FAILURES RELATED 
10 FUNCTION B 
BECAUSE OF FAILURE 
3FTASK 1 



ETC.—r 



CI 



FAILURE OF 
BECAUSE OF FAILURE 
OF FACTOR X 




Bl 



TO PUlftlON B 
lECAUSE OF FAILURl 
TASK 2 • 



.ETC. 



FAILURE OF TASK 1 
BECAUSE, OF 
pEQUATE FACTOR 
Y . 



FAILURE OF TASK 1 
BECAUSE OF 
FAULT^TASKZ ■ ' 



FAILURES RELATED 
TO FUNCTION B 
BECAUSE Of. FAILURE 

OF taskI ■ ■ 



h ■ 



* INDICATES TRANSFER TO OTHER FAULT TREE 
BRANCHf S FOR CONTINUED FAULT TREE DEVELOP- 
MENT. UTILIZING FUNCTIONAL, TASK OR OTHER' , , 

- FAILURES ELICITED FOR LOI0 LEVEL FAULT ■; , 
TREE DEVELOPMENT 



^Figure 5. General format for 'qualitative fault tree construction, "Scoping the Tree." 
ERIC' 
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^. Methodology and depth of resolution . In generating the fault 

tree, the basic c(uestioa se«ms to be: "Given a SDocified UE, what: 
sequences of events may possibly take place to result in the actual 
occurrence of the UE?" Drawing the fault tree is a deductive 
prooess and the general methodology is to identify predecessor . events 
from the top of the tree successively down to initiating or primal 
J^vpivirt^ events- . Once consjtructed — and in the* process of construction~ 
the tree is re^d, from the top down, noting at each level whether events 

are inputs to AND gates or OR gates. ■ \ • ^ 

■ ^ ■ \ ■ 

In the process of quaflitative construction, the analyst shouW 

be extremely specific in formulating failure statements. Every failure 

statement should contaitj fouir vital words: "Failure of . . .becau3.e 

of**." (Stephens, Class Lecture > November 18, 1975) .or a suitable 

^euphemism' for them. 

In making failure statements a suffix-prefix relationship should 

, ■ *• • , ■ 

exist—that is, the suffix of an output failute event becomes the 

prefix of an input failure event. In addition, failure statements^ 

I- . , 

should attempt to use a descri|^ve adjec^ve^, usually with a negative 
connotation. For an example of the suffix-prefix relationship and/ 
descriptive adjective see Figure 6: 



C 



ERIC 



23 



4 »' 



Evertt A 

Failure of 
mission because 

of iinprone<: .. . 
function A 








^ent Aa' 






Event AB 


Improper function 






Improper function 


A because of 






A because of ' 


faulty task D 






inadequate / 


1 




task B , 



Figure 6, Suffix-prefix relationship, descriptive adjective^. 



/ 



In this example . (Figure 6), the wor^ improper in Event A is a 
negative descriptive adjective and also the. Suffix to the failure 
statement of Event A, In Event AA, the word improper maintains its 
role as a negative descriptiye adjective, but now is the prefix to the 
failure statement o.f Event AA. The same is true of the word improper 
in Event AB, In this example it is understood that Event' AA and 
Event AB both require further development . 

There ane no firmly set rules in-^breaking events dbwn frota one 
' level' to another. The general procedure is to ask questions regarding 
each event, chiefly, "l^at are the immediate probable causes of this 
event?" (Stephens (Class Lecture, November 11, 1975) has suggested a 
"Systematic Five Step 'Approach to Qualitative Fault Tree Development" 
for consideration in the development of each failure event: 
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1. . Seek* expert advice from aiithorities — of which you may be 

one — in lookiln,* for contributin^'f actors v/hich can cause 
failure of each event'. 

2. Consult printed liter^ure. This may involve specialized 

. research to become better acquainted with the system being 



analyzed. 

-3. Brainstorm with a grou{^. This triggers thinking from others 



and often is a means of ha"^ing one thought \uild* in anoth^. 



f 



^» Consider j^ll possible primary,' secondary, and command failures 
ij/primary failure, repr.esented by a circle, is a basic 
failure which is inherent in the unit of analysis and needs , 
n<3 further development. A secondary failure is repfrespnted 
by either a rectangle or a rhombus, depending on 'i^hether^ 
the analysis is to^ be developed further. It is an envirQn7 
mentally induced failure. A coppnand failure is one in 
which the components is ordered into a "failed state." It 
doea not represent failure of the component itself^. Command 
failures can be represented by either a rhombus or a 
rectangle. 



5. Attempt to locate the input , processing, and output failures 
of each event. This is accomplished by systematically asking, 
questions regarding e^ach event to determine those factors 
which could potentially contribute to failure of the event. 
For example, failure of a certain portion of the system may 
be attributable to failures of input from another part of the 
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system, failures of processing within a specific portion of 
the svstom, or failures of outpuL to aaoLhc^r part: of the 
system. . 
It should be remembered that in effect Fault Tree Analysis the 

■ L . 

purpose of FTA is not to analyze all the possible, failure events, 

just the niajor ones. The aboVe suggestions are helpful mainly as 

^ . -■ ' '' 

checks for "the analyst to be sure that no important events are pmitted. 

As the* analysis proceeds, it will be. found that very similar ^ 

events, or even identical Wes will often shox^ up in different branches 

o£ the tree. This is )si signal to the ^analyst to examine them in. more 

.detail, particularly if it id felt that the likelihood of their . 

occurrence is high. ? ^ 

. The analysis will be more accurate and efficient if it is done - 

horizontally rather than vertically (Stephens, 1973) — that is, if all 

the inputs to an undesired event are generated at the same level 

before proceeding to tne next; level. The analysis need not proceed 

any further^ than the analyst desires. Some events may be represented 

by 12 leyels, whereas others may be developed to only two. The 

general rule is that W^h failure event shctuld be developed to a 

point where cause and effect relationships can take place (Stephens, 

i' . ■ , 

Class Lecture, November 11, 1975). The bottom of th^ tree for any 

branch will always have terminal events depicted by^a circle, rhomubs, 

or house. For each evejpit represented by a rectangle, there must 

alvxays be at least tv7o or more inp^ events. 

Validity pf the tree . Once the tree fias been completely drawn 

it is validated wherever each terminal event o'ccurs. The purpose is 
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to determine th^t the tree is thorough, properly drawn, and is true 

r correct to thn syste:a Heiug analyze^'. The procoso for validation is 
an follows (Spepheris, Class Lecture, November 11, 1975): 
1. Each rectangle should state an undesired' event . 
2.. Each terminal event should be studied closely. and the question 
asked, "If this event really happens, is there any way in ' 
whicli it could be avoided?" If 'any way carl be found, to 
avoid occurrence of the event or an exception j^ound to it , 
then an AND gate should be drawn above the ^vefat (it would 

replace the bfU-gate if there j^as not an AND g^'te previously) 

* / ■ 

and a new event explaining the exception wyou^d be inserted 
in the tree. Simply stated, the tree is validated at all 
bottom or terminal events by considering^ whether it is possible 
. to^ add AND gates and dtiterroining where they should be 

placed.,, ^ ' . X 

■ . ( 

Labeling events in. the completed fault tree . Prior to quanti- 
tative evaluation, failijre events in the completed fault -tree are 
labeled for quick and accurate location within the tree. The ' • 

method for labeling events, designed by Stephens (Mimeographed Paper, 
1975). uses a xiombination of the letters A-Z to identify each event. 
V This combination constitutes what is called the "locatioij cocie" and 
works as follows: (a) The code for a level one event is A, B, C,...Z. 
(b) The code for a level two event under Event B would be, BA, BB, 
BC,...,BZ. (c) The code for a level three event under Event BB 
would be BBA, BBB, BBC,;..,BBZ. (d) etc. (see figure 7) . .The number 
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of letters in a location code indicate the level number of that 
event. For example, Kvent BBC is a li^vel three event • ^ 

Quan 1 1 ta t Iv e e valua t lo n • ^ 

' '. r ^ V 

It is not necessa.ry for most of the team members engaged in 
qualitative fault tree development or quantitative evaluation to know 
more than the rudiments of fault tree principles (Stephens, 1976). Nor 
is it the Intent expressed in this paper tOj go into a dietailed 
account of the mathematical principles upon whicli quantification of 
FTA,.a5 developed by Stephens, is based. Nevertheless, an explanation 
of the meaning of quantitative evaluation of Fault Tree Analysis is 
necessary and some basic principles related to it^ should be 
^derstood. - » 

Quantp^tive evaluation (quantification) is the prioritizing 
and ranking of ^specified failure events^against each other in order 
to determine high priority failure event sequences — the likelihood 

c ■ ' 

of occurrence of fault 'events. The objective is to identify and 
isolate ^ strategic path (critical path) of failure events leading 
frbm the bottom of the tree directly to the top. A primary strategic 
path (one of great.est emphasis) , as well as a secondary strategic 
vpath, alternate strategic path, etc. can be identified. The importance 
of finding the strategic path is that it is a clear indication to the 
decision maker (s) as to the weakest links in the system and provides 
information necessary for correct decisions (Witkin, 1971). 

The methodology used in the aerospace industry to arrive at 
quantification is not applicable to educatioprdlT^and^so^ systems 

due to its objectivity. Accordingly, Stephens (1972) derived a 

■ • . ' . ' <, 
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1 ■ ■ 

subjective quantification technique ior strategic path analysis to 

be. used sp^6ificaLly on fault threes .clraun for social r.ysteTns. This 

tephniquG,, is based on (1) an approach utilizing expert judgment3 / 

based on training, experience, q,nd in some cases research ^ata; and 

i2) through f otmulas d„erive^ from; Markov Processes and Boolean Algebra ' 

to yield strategic event valfies in order to identify strategic pa^ths 

of interest by introspection. An explanation of the mathematical ^ 

principles is beyond the scope of this paper. 

The method for collecting and organizing expert opinion is 

^ • • • • 1^ 

achieved via a Modif ied Delphi Approach devised , by Stephens (1976, 

p. 13). The process utilizes four basic subjective judgments as. t 

follows: , , 



i 1. Starting with the top UE, rknk in order of relative 

contribution (or importance^ each of the failure events 
leading into it. \^ - " , 

' For all of the inputs through a given logic gate to a single 

more general event, determine the percentage contribution 
made by each event to the more general failure event above 
< " * it. Percentages should sum up to 100 for each event. 

-2. Determine confiirence. in the percentages (sftrong, moderate, 
and WQak are cdpmonly used).. 

Repeat the above two steps for the inputs to each failure 
event, "forking systematically down through the tree. ^ ^ 

3. Determine the appropriate^^equency rating fot each terminal 
ev^t at the bottom or lowest level only for each branch of 
the tree (rarely, periodically, and frequently occurring' 
ar*^ commonly used). The rating for each input to an event 
is determined, independently of the other inputs for that 

* same event. 

» . «• •* 

4. Determine the rectification for each end (terminal) or bottom 
^event only (permanent damage or impossible to rectify, difficult 
to rectify, and easy to rectify are commonly used). a 



AA* FTA computer program is on file Bri^ham Young University 
'designed by Stsphens (Collin^^s, 1975) , . vjii.rli can b ^ .used to determine 
algebraically the relative probability of occurrence of failure events 
ifor deriving strategic paths (as well as for drawing the tree). For 
trees of less than 300 events, the mathematical caldul^t ions can be 
done by hand^ however, this can be somewhat time consuming. For 
trees with over 300 events, and where it is the. desire^, ofe *the analyst 
to determine the strategic path via a computer program, Stephens 
(Class Lecture, December 2, '1975). has diagrammed a FTAP (Fault Tree 
Analysis Program) Quantification Input Form to aid in the process. The 

0 

input form (see Figure. 8), an extension of the Modified Delphi 
Approach used by Stephens is extremely helpful in recording the 
four basic subjective judgments discussed earlier. Using the form, 
failure eyents can\be entered ' into the computer; to yield strategic 
event values in order to identify strategic paths of* interest. The 
FTAP Quantification Input Form and FTA computer file at Brigham 
Young University is capable of ^handling a fault tree of any- configura- 
tion subject to the following limitations: 

« ■ >■ ■ - p- ' • 

1, up^to 16 levels o£ events 

2, ^ up to 26 events below a rectangle event 
* ^ 3, * up to 2048 events in the ^fault tree 

On small trees (less t;han 300 events) much valuable information 
can be gained about the system by simply inspecting the tree without 
necessarily completing the quantification.^ Events could be ^ 
subjectively ranked against each other on each level to determine the 
strategic path without calculating the relative probability of 
occurrence. * , 
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Formulating recommendations 

« j 

The final stGp in conducting a Fault Tree Analysis is to malce* 

recommendations based on the qualitative construction aryi the strategic 

path analysis derived during quant^if ication. In^ddition, through the 

drawing of a fault tree and itfe analysis, an in(flvidual or team*of 

experts can easily identify areas in which special care shcJuld be 

given within a system t;o better* insure success. If the analysis is U 

made during the design of a new Rjpogram, the decisions based on it could 

confirm original feelings^ or lead to desigh changes. Recommendations 

based on the completed tree apd identification of the Strategic path i 

may lead to reallocation of resoairces^ installmei^^. pf backup • s^s t^^ms, • 

monitorii^g '^pf ,paths with high failure potential, provisions ; for improved 

coitaiunicat ion's , <yic the taking of corrective action -which, s^eiris .advi's^able 

(Stephens, 1974, 1976). Furthermore, visually displaying the •c<{mpleted 

fault tree -and discussing the strategic paths with personnel at varioils 

levels of the organization often results in the formation^of excellextt:^, 

t . ^ ' ' ' ^ ' 

Suggestions for improvement and creates an appreciation for • the entire 

system seen as a whole. ' . ^ . ' . 

. (r ^ 

■ One of the great values of FTA, as it: relates to the formulation 
of rfecommendations, is that emphasis is focused largely on • the Tjottom 
levels QT' terminal eveptfe of the tree. , \JjE^ each bottom eve^it is avoided 
or * rectified*, t"hen logically the entire sequenjce of .failure events 

abpve it would likewise not occur (^Stephens, Class' Lecture, Dec£?mber 

---^ ■ . " ■' ' * " ]. ' ■ , 

2, 1975)* .Hence, In formulating recommendations, not only is the 

stT^^egic patji investigated closely, but a^sq each teAninal event of 

interest* " . ' 



This concludes a description of the geheral steps in fault tree 
construction and analy^^is,' It ±o important to noJie that the fai>lt tree 
approach can be used in a more simplified and abbreviated fonn and 
still be very useful. In fact, it has been demonstrated by decision * 
makers that they could derive useful information from any of the steps 
followed in perf ormiTUg a Fault Ti>ee Analysts (Stephens, 1974) • 



Present Use of Fault Tree 



Analysis in Education 



As indicated earlier in this paper, the first full scale applica- 

■ ■ - .. . 

tion of FTA to education was pioneered in 1967-68 by Witkin and 
Stephens under the ^cGspices of the Alapeda County PACE Center, fiayward, 
Calif ornia (Witkin and Stephens, 1968) . The purpose of that study was 
to develop a master plan of occupational preparation for youth in the 
sc^ols of Alameda County. Identification' of the UE in the Fault 
Tree Analysis was: "Failure to be employed full time in an entry- 
level job with possibilities for advancement." (Witkin and Stephens, 
1968, , p. i25) . ^The tree had eight distinct, but related branches with 
well Qver 700 f ailtire events. The average depth of resolution was 

' /' ^ . ■ , ' . ' 

seven levels, with some -branches extending to level twelve. ^ A 

' . • • • . . V ' 

strategic path was calculated which revealed the moat probablfe modes of 

occurrehce wil:hin the system. Even a ^simple inspection of the tree 

provided very useful information about potential hazards which j was of 

vdlue to educational decision makers in vocational administration, 

curriculum, development , etc. (Stephens, 1973). 

• ' The study resulted in many findings, the major ones of vhic 

indicated that the preparation for employment sLnd the actual process 
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of employment is more complex of a problem than is often assumed. The 
need for improvement of oral conmunication skills, individualizi^ 
instruction, formulating adequate objectives and teaching strategies, and 
correct assessment of student abilities was noted CWitkift and Stephens, 
196iB). Information gleaned from the tree was made available to educa- , 
tional planners for system -Redesign, proper allocation of resources, and 
planning for. future needs. This' initial attempt to ap^y the fault tree 
technique to education demonstrated the feasibility and value of Fault 
Tree Analysis in resolving somd problems in vocational edueation 
(Stephens, "1972) . 

Since 1968, Witkin and Stephens have successfully applied Fault ' 
Tree Analysis gp other problems in education.' In 1972 application was 
made to organizatrional communication systeijis (Witkin and Stephens, 1972). 
In 1970 Stephens conducted a FTA of /the Church o& Jesus Christ of Lat ter- 
Day Saints Church Education System throughout the South Pacific (Stephens, 
Distinguished Lecture Series, Utah State University, Jfe74). * In, 1972 he 
devised a subjective quantification technique and since then has acted as 
a consultant in applying Fault Wee Analysis to many areas of education. 

At present, the relativeiy^few people skilled in Fault Tree 
Analysis limit its current .use in education. Most of the current studies 
using FTA as a research tool, have been undertaken at feri^ham Young 
University and are of recent origin— ^largely due to (the fact that Dr. 
Kent Stephens ;is presently affiliated with that university and is there . 
teaching the technique. ^ /cr 

'' During the 1974-75 school year , 'Pollings „ (1975) conducted a Fault 
Tree Analysis of a high school recreation program in order to develop 
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recommendations for teaching students how 'to effectively use their 
leisure time. The study v/a-^ undcitrtnken *at two selected school districts 
in British Columbia, Canada^j^^^^^ln developing inputs to the qualitative 
'fault tree and in quantifying it, a committee of nine experts expended 
appro3tiraately 100 man-hours - (Collings, 1975). In addition, Collings 
spent about another 150 man-hours in clarifying and rewriting inputs, 
preparing the quantitative data for computer processing, etc-^ The 
completed fault tree depicted 479 failure events. With one except ion^ 
all logic gates were OR gates. Four major divisions or branches of^ 
the tree Vere developed, varying in depth of resolution from three ^level 
to nine levels. All failure events were secondary events (rectangle 
or rhombus) except for two houses and one circle. 

fHelson^ (1976) conducted an extensive Fault Tree Analysis at the. 
Colipfege of Eastern Utah to determine the cause and effect relationship 
which resulted in the college's failure to: 

1. Provide educational opportunities which met basic academic 
. ■ needs of students. 

2. Provide educational opportunities which serve student 
^ / voca'tional needs. ^ 

3. Create an atmosphere which encouraged fulfillment of student 
social needs and development of a positive feeling of self 

worth. * ^ 

** ■ * 

4. Serve the professional needs of its personnel. 

5. Serve the education needs of the Eastern Utah community. 
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> Over 30 members, of the faculty, staff , studentbody , and coininunity 
ware diu-^ictly involved as coir.tnJ.tte^ ai-jinberf:; in qualitntiive faalt tro/^ 
development \aad quanti,tative evaluatiotu Approxiiaatelty 500 man-hours 
were spent l/y the committee and 810 failure statements related to the . 
mission a^4^.geaJ« of the College of Eastern Utah were generated (Nelson, 
1976) • 

During the 1975-76 school year. Long (19.76) applied FTA as a 
research tool to identify and'prioritize internal communication failures 
within the community college ci^:6trict thrpughout the Ventura County 
Community College District, Venturd, California. Long selected nine 
committee members from among key mans^gement personnel of the local 
community college district with a combined total of 159 years experience 
in community college administration. A total of approximately 150 
man-hmirs were expended by the committee in perfo^ing qualitative fault 
tree development and in quantification i An addife%.onal estimate of 100 
man-hours was spent by the analyst in re\^iting input failure statements, 
preparing,^ data for quantification, etc. The completed tree had 474 
failure events. All logic &Stes connecting failure events were OR gates. 
Th\ee separate branches of the tree were developed. ' ^ 

Gopelan^d (1976) has most recently conducted a Fault tree Analysis 
in the Department of Physical Education at Brigharii Young University, 
Provb, Utah to identify possible problem areas within that department. 
A committee of faculty members anf^ graduate students assisted in the 
qualitative development and quantification of a fault tree made up of 
A33 possible failure causing events. 
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^ . ■ • h:::'\tTLE of a FAUr.T TllKi: ANALYSTS 

;■■ ■ ■ ■ ^ . 

In this section an example of a mission analysis and the qualita- 
tive construction of^a fault tree is presented. Although the fault tree 
presented in this example was dravm specifically for use in religious 

education, it is useful as a prototype and to a degree can be used as • 

■ ■ ■ " * 

a general model. The tree should not necessarily be construed as 

■ ■ /. , \ • . . . ' , 

; representing the final drawing. It could, if desired, be developed 

further and in some cases altered. The analysis of the prototype fault 

tree lias been undelrtaken only to the extent of drawing the tree and 

verifying the inputs (validation) . Quantification of the tree requires 

a probabil'ity evaluation which is beyond the scape of this pape;:. The 

^ fault tree, herein described, is displayed in the appendix of this 

paper. - 

^ ' Problem Identification 

The Church of Je sus Christ* of Latter—day Saints (L.D.JS.) operates 
• - A released time religious , education program (where enrollment warrants 

and local laws permit) throughout several western states (Utah, Arizoyia, 

. • ■ • . &. ' ' * 

Idaho j^t^Nev; Mexico, and Wyoming). Students participating in the program 
are released from* t^heir regular public school classes for approximately 
one hour each school day to attend seminary, . where, in a religious *^ 
\^)|||btting L.D.S. Gospel precepts are taught. Besides daily tlass 

instruction, numerous aJfter school' activities and extra-curricular ' 
^ activities are available- for interested students. These activities are 
generally^ un^er tfic direction of specified students selected by the 
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ive spiritual experiences*. The 



seminary faculty to serve as seminary off ic;j2rs or student leaders. 
It was the desire of thr» aufbor to assist in the devel6pfnei;Lt: and adrainis- 
tration of an effective student lead er ship <*program for use/ in small, 
released time L^D.S. seminaries. 

A systems definition was under taken^nd bounds and c^straints 
were identified so as * to limit the student leadership pifogram for 
use in released. time L.D.S. seminaries /With an enrollment of 250 students 
or less, staffed by one or t^o teacher^; which would promote fl^ndship 
among students, instill a desire for students to learn the Gospel, and 
provide opportunities for students to 
exact mission statement read: "Develapment and administration ''of a 
student leadership program in,^releascd~time seminaries, staffed: by one or 
two teachers, which v/ill promote within each student enrolled in class a 
feeling of acceptance by peers, a desire to understand the Gospel, and an 
opportunity to feel the influence of the Spirit." 

Based on' the mission statement and system definition, a mission 
analysis (see Appendix, Figure 9) was performed which identified 
ive basic functions and 18 distinct tasks. , ^ 

In viewing the mission analysis, several undesired events were 
considered and it was decided that the UE would be: "Failure to develop 
and administer a student leadership program in released time L.D.S. 
seminaries staffed 'by one or two teachers \7hich will promote within each 
student enrolled 'a feeling of acceptance by peers, a dGsire to understand 
the Gospel, and an, opportunity to feel thip influence of the Spirit." In 
this particular case the UE happened to be the reciprocal of the mission 
statement. . • 



■ * 

Qualitative Fault Tree Construct£oi| .« . 

*' • . * ) 

QaalitatiVG-. fault tr^e cou^tructioa icas begun by scoping thfe 
itiitial levels, of the tree derived from the mi's s ion analysis.. 

* Most of the events depicted , in the fault tree in this paper are , , 
secondary (rectangle or' rhombus) failure events. The tree has five 
separate branches and levels of development for any single path range 
from two levels to six. The completed tree has 141 failure e^'ervts.' > 

The actual. generation of the inputs in the qualitative development 
of the tree was 'undertaken chiefly by the author with some assistance 
from the seminary principal at Bountif ul-Millcreek Seminary, Bountiful, 
Utah and the district coordinator of the Davis County Seminary District. 
The. "Systematic Five Step Approach to Qualitative Fault Tree Development" 
suggested by Stephens (Clas^^ Lecture, November 11, 1975) was utilized in ^ 

formulating failure statements for use in development of t^ji^tree. 

* ■ 

Approximately ten hours was expended in formulating input^jjf^ilure I 
statements) and another eight hours in clarifying the sta^einents and 
/Actually drawing the "^ee. The iiiter-relationship of ;Eailu|||^ fyents in 
the tree are depicted only^by the OR logic gate . ^ The ^AND, lo^ic gate .is 
not used in this fault tree. \ 1 . ^ 

Recommendations ■ k-^V-/^ J' 
~~ ' 

The entire process of quantification was ji6t-:Wije,i;l;kife^^n^^ 
prototype fault tree. The tree was inspected thoiroug}:xi,y. by^ 

principal, district coordinator, and the author and\Vt -.soip'^ l^V^^ 

\ ' ■ ' ; \'r '. ' ;■ ■'■ . 

were ranked against each other. Although numerous 'Siig^eSticajSY^^ ^ 

V ' 'V , "^^ .-.t ■ * ■ • ' 
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from tie inspection of the tree, the following were airong the major :^ 
t:*i*-idad .raconunendaLiops:"* 

1. I" ;was agreed thaC n written jab d^iic.ription bs mado. available 
f ojt each student officer listing his specific duties as well 
as those of other officers. 
2» It was agreed that student leaders be in charge of and delegate 



-authority to contact and commit peers to attend morningsides 

K. ' ■ ■ \ X 

(inspirational me^etings), testimony meetings, and othct^student 
.' activit^.es. — 

3. It fwas determined that a regularly scheduled weekly meeting 

(specifying time and place) was necessary between . student 
• * ■ 

leaders and .teachers to coordinate activitie-s. 

v. 

' • ^ .• - ; • • 

4. Student leaders were given responsibility to assist' in 

^ • . 

motivating peers to keep current in assigned class reading. 

5. Student leaders wer^ placed in charge of , classroom devotionals, 
. being ijble to receive assistance from the teacher if de'sired. 



} 
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CONXLOSIOM" 1 

. • ■ .1 

In October of 1968, V/itUin and Stephens (p. 42) wrote: 

At the point to which f tree analysis has now been 

developed for educational problems, it is not possible to predict 
' its ultimate usefulness to educational planners. Certainly, the 
.state of the art is not yet at the point where its* full potential 
can be uniequivocally demonstrated. 

Ten years has seen considerable development of the" f^ult tree 
process, largely due to the work of Stephens in devising a subjective 
quantification technique, "Although the relatively few persons skilled 
in educational FTA presently limits its application, the efforts of 
Stephens and others in teaching the technique -will certainly have a 
mushrooming "effect as time goes on. 

Fault Tree Analysis is not seen as a panacea for use in the 
systems approach, nor is it necessarily a replacement for .other forms 

of* systems analysis. Its effectiveness stems from its focus on "how 

%. 

things can fail to work" and from this perspective it is of great Value, 
for it leads to .explicit recognition of possibilities for trouble which 
might otherwise be overlooked. 

Ultimately, the value of Fault Tree Analysis lies in its potential 
for accurately identifying those failure mocl^es within a system which, 
if prevented or minimized will increase the probability of success of the 
system. The suggestion is not intended that mere avoidance of 
identifiable failure modes will guarantee success, but it definitely can 
promote success. » ' , 

One factor which can considerably facilitate the use of FTA is . 
that it can be applied as a most simple or a most; sophistitated 
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analytical tool, depending on the needs of the analyst. The concepts of 
Fault Tr?>e Anril»/t;is ar? ou tr.f:rindTn'£,ly \o 'molG, bojv-.nr.-^.r , coaLT tructir./, 
suitablQ ,fault trees— SGpecially for couulcx ed-ucational .systaas-- 
requires thorough understanding of the system beiug analysed (or immediate 
access to individuals who do) as well as a mastery, at least for the 
♦analyst, of the techniques of fault tree construction. Team jiembers 
assisting in an analysis need only understand the rudiments of Fault 
Tree Analysis. Undoubtedly, the future of FTA in education will depend 
largely on the number of individuals drained in the technology, who 
also possess an ability to adapt it to per|:inen,t problems in. education. 

One final note. In the opinion of the author, it is a wise 
administrator who designs processes which enable decisions to be made 
by others and does not make all the decisions himself. He permits 
people, within limits, to choose for themselves. Fault Tree Analysis 
does hot'say, "Do these things and you -will be successful." Rather, 
by /identifying what not to do it seems to be procfainring, "You are 
free to determine the avenue which is most^ suitable for you to achieve 
suc(^ess, however, these strategies should be avoided in order to enhance 
the possibilities for success.*^ In a Biblical context, FTA declares, 
i"Thou mayest choose for thyself, for it is given thee; but it is intended 
that thou Shalt not fail!" 
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Gate Symbol 
Output 




Definition: - 



The And Gate describes the *lo^cal 
operation x/hereby the coexistence of 
all input events is required to 
produce the output event. 



The OR Gate defines the situation 
whereby the output event \o.il exist 
% if one or more of the input events' 
exists.' V » 



Inputs 



Output 




The PRIORITY. AND Gate performs the 
same logic function as the ^ND' Gate 
with the additidftal' stipulation that 
sequence as well as coexistence Is 
required. " ' ■ 



Th^ EXCLUSIVE OR Gate f unQtions, as ' 
an OR Gate with the restrictions that 
3pecified inputs cannot coexist. 



Gate Symbol 



bef Inltior^:^ 



(periodic) 



Inhibit 
condition 



(permanent) 



Output 




Output 




Inputs 



iNHJBfx Gates are ANlj Gates in which 
one of the inputs occurs with enough 
consistency to inhibit the other' 
inputs. The other input events 
directly produce the output event if 
the indicated condition is satisfied 
^or occurs. The condition is.^ 
represented by an oval if it describe 
a specific failure mode, and a . 
rectangle if it describes a condition 
that may exist for the* life of the 
system- - — ^ *.'(■,' ^ 

(Stephens, 1973.; p. 34) 



Fault 



Events 



bvcnt §yir,boX 
Output , 







.> ' ^. ' 

f/^ The Pt\TRIX Gate an abbreviated „ 
vrepresent^Ltion of a combination of 
ev^.nt|J, yhich can.be represented 
by^a series jjf AND Gates syruned 
flf togethaj by an OR Gate, in which - 

sgine of^ the inputs are common among 
^ the differitflt AND GateS. 

€^ V * 

^ ' * ; .'> / •< 

, The RKCTAlSfciE identifies an event that 
1 ?eSults from the .combination of fault 

e^yenlfrs t}irough the ifiput logic gate 
or for which|j^dditional fault tree 
development exists. The event is an 
input to tl^e .lo^ic gate above the 
rectangvLe. 

» The RH0!4^US describes a fault event 
which is not developed further in 
the tree, because (a) the necessary ' 
information ;Ls unavailable, (b) the .. 
evdnt is relatively unlikely, or 
(c) time, technology,^, or bther 
constraintfii -preclude analysis to ^ 

further depth. 
.V. „ * 

The CIRCLE. describes a basic fault 
'■■ event that requires no further 

development. It is a primary ^ P 
failure of a discrete element due - 
' ' J ' ^^o*^ its internal conditions. 

The OVAL specifies conditions among .* 
^inputs to Igcgic gates. It defines 
|-the state of the system that pewits 
a fault sequence to^x)cc\j^jp^jiand may 
be either normal to the system or 
, result *from preculiarit'ies among 

if allures. ' 



Event Symbol 



A ^ • 



Definitions ; 

Tp.fii HOnsR indicator^ an evont th-itivls 
nornialiy expected to occur, such 
as a phase change or periodic 
surge of events in a dynamic system. 
It is a basic input, requiring no 
further analysis. 

The small iTRIANGLES are used as 
'transfer symbols., when parts of the 
tree are transferred to another 
page or section of a page. A line 
from the apex of the triangle>« 
indicates a "transfer in" and a liije 
from the side denotes a "transfer 
out," of a portion of a fault tree. 



(Stephens, 1973, p, 35) 
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F unction A 
Providing an 
opportunity for 
'spiritual exper- 
iences 




Tasks ' 
Devotional?; 
Testimony Meetings 
Read ing /Les sons 
Morningsides 



Mission Statement 
Development and ad- 
ministration of a 
student leadership 
program in releas- 
ed-time seminaries, 
staffed by one or 
two teachers, 
which will promote J 
within each 
student enrolled 
in class a feel- 
ing of accept- 
ance by peers, a 
desire to under^^ 
stand the Gospejt^, 
and an oppor- 
tunity to feel 
the influence 
of the Spirit. 



Function B 
Creating and 
maintaining an 
atmosphere of 
social accep- 
tance 



Function C 
Organizational ^. 
planning 





Function D 
Leadership ' 
.traininj^ 




Seminary Socials 

Monthly Zone^ Meetings 

In-class activities 
which involve social 
interaction and every 
student, in olass ' 

Selection of Leaders 

Explanation of duties 
of ^ leaders 



Training o-f seminary 
council officers 

Training of head class- 
room zone' leader 

Training of classroom 
zone leaders 

Counseling & consultation 



Function E 
Motivating 
students to 
want to under- 
stand the 
Gospel 




Readying 



Lessons 



Class discussion's 



Figure 9. Mission analysis prototype fault tree 




, mmm mi 

Failure fo develop.'and administer a student 
leadership program in, released time L.D.S, . ^ 
seminaries staffed by one or two 'teachers ■ • 
which will promote within each student enrolled 
a feeling, of acceptance by peers, a desire to 
understand the Gospel, and an opportunity to^ 
f eel ihe influence of, the Spirit 




A " ' ^ B 




Failure of mission ( 
because of lack of i 
opportunities for 
spiritual experi- 
ence 


?ailure of mission 
1 jecause of inade- 
quate atmosphere 
ior social 
icceptance 




Failure of missio: 
because of impropifr 
leadership triin 
ing . 




Failure of iiissloi, 
because of udsuc- 
cessful ijtuiient 
motivation iq 
Md£isJ:4^tli&JG^pel 



Falbfes relafttUb 
omnizational pmning 
betoe of failjrfe to 
detemi^e duties and 
responsibnities of each 
leader 



CB 



Failuj 

omizational 
bbc^ 
select^ 



CC 




Failures related 
organizational pi 
ning because of 
failure to .sel ect 
good leafors 



0 

an- 



Figure 10, Prototype fault tree. 



7^ 



£C 

Failures related 
to organizatlotiall 
planning because (| ;,'( 
failure to select 
good' leaders .' . 



A 




V)'' 

' ' ' ; ' ' ' ' / ' 



to select ■good headers 
i' l^^^^^ of ins\]fficient 
Infofiiatlon about prospfiCtive 
ts prior to select: 



I . ( ;■ 



; /■.■III 4 ( '■;'* ,! t; .' ' ■ 
''^ ''V'V •^■i ^ tj' 



A 



^ CCBA 

Insufficient info 
propsective le 
failure to o 
leaders reg^r 
abli:^ty,':pd 
■•'aet'ivitles • 



Pigure 10, Continued. 




about ' ■■/.Insuffi^^^ 

-Ibbwf ■ IropDpdiye j oaders" 
' ■ b^uffij(^>i^i|^^ 10 desi 

ai^lcati^i||o|ras^ 




Failure of misslor 
because of lack of 
opportunities^ for 
spiritual experieijce 



AA 




lick of opportunities 
..f ir Spiritual exper 
H'lnces because of 
iiadequate devotion 



Lack? of opportun- 
ities for spiritual 
experiences because 
of urisucce'ssful 
lessons in c^lasS' 



"A 



Lack of opportuni- 
ties for spiritual 
expediences becausfe 
of^lailureS relatep 
tn-ninmingRidfis 




Lack of opportuni- 
ties for spiritual 
experiences because 
of unsuccessful 
testimony meetings 



tack of oppcrtuni' 
ties for spirituai. 
experiences becau 
of failure of 
students ,tc read 




Failures related tp 
norningsides becau 
ofVoor student 
attendance at";, 
norningsides / 





•ACBA 

Poor studentXttetoce at ■; 
morningsjdlis because^ failure 
of tea(<^er to advertize/and 
encourage\tudent atraidance 




m 

Poor studen 
because 
contact 




j^t.top^iilingsides 
ent leaders co 
9 to attend' 



i Figure iO. Continued/' 



AAA 

Inadequate 
cause of 
teach 
planned^ 
titinals 




■ M ■ 
;'■ Failure on 

leaders to 

tionals<^caus€ 

creativit; 



AA 




Dpportunit ies 



Lack of op 
for spiritual 
because, of inadeqdate 
devotionals in'clilss 



exp(rienc6§|l^ 



1- » 




1^ /ll 




AAB 



AAC. 



Iijadequate deyotionals!- • Ina lequate'devol^onali 

because of failute-oi becm,se;o{:.ia|luW^ 

part of student leadsrs stulents pai^|pa 

tc plan good devotioials on levotiohalsf " 



If 



. AAD. 

' Inadequate 
becau 

;e vari^ 





A- 



/ 




.Student Failure on p^ 
- sludent 



erss to pj 
good devotionals because 
of lack oKteacher 
motivation aitias^tance 



AACA 

Failup/oNtudents 

[Jarticipat^ 
^evotionals becauiie of 



AADA 

Failun^U': 
tO/p^irtkipate 

flvotional 



.udents 



b^cauE 



anthe st^iM leader^cio 

• studeX^shy, fear, not inaiidi>4ein in 

revellious attitude, etc.) devotional planning 

* , ■ and presentation 



Figure 10.. Continued^. 
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r 



< 



Lad of^l^portuhlties 
for spfrituar experience's 
because of unsuccqspful 
lca8on5/in class, 



Aba , 

ynsuccess^u/lessonsMn 
' dais because of failures 
^ inheretit' it the studeijts, 

and/or ..teaflher 



Unsuccessful less^^ns' in 
class because of vailurc 
'of tei.cher to prc^sont 
lessors which arc applic 
,vu \<i nt^edf, of th 




AM 

Failure oLafudeW^ to 
'listeft^lessqhs ^b^use; 
iessolCobjectives do ijpt, fit ^ 
:the qeeXflf the sj;^^ 



Fai]ure of stildiints to 
listen 'to Ifessons' 
beciuse of pooi: cUSs- 
■ rdon discipline 



Lack,p|:stiiiii#nt,; 
interest because^ 
of poor classroom 
discipline: " 



Lack of stuiJifitWrest 
because i)frailures-j 
relatei^to teaching ^e^ods 
used by ?^cher 



ABM' 



Figure 10. Continued. 
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I' 



Lack of student 
interest because 
of poor classrooi 
4isciplii)e , 



<J 



ABBBAA ^ 

Poor ■cUssrA^isciiSline 
because/efflfailur^o 
provide comfortable 
phys,i^^svrroundir 



AEBBABA 
Failure of ^ss^ leaders 
to..keep/lass contrM^d and 
recepte to lesson because 
of peer/|H;essure 



A 



ABBBAB 



mm 



Poor cUssroon disci^lin. , . . ^ < "^l^'^T^^f^ 
because of failure of , / ■:^*'/^ff 

classroo.laaders.to ,^eep ■ , ' ; teacher W 
.class lolroUed and receptive ^ to. the needsNiJ^ 

to lesW ' ' — ' * . . 'f 




ABBBABB 



ABJBABC ' 

Mta of.cb^sta leaders Failure of 'cWoV^^ders 

fo£ dJfcon^^^ and' ^ . ' to keep cla^ontroU.^nd 



receptive to lesson bec|jj6e 
of lack M^interest lyi^sons 
themselves 



rece|iva(to l^son bacai^ of 
apparent W^^^^ teaph^ concern 



oipelP:. . 



\ 



'Figure 10/ Continued. 
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.■ft 



J. 



ABCA 

"Itiiproper 




ABO • . 

Unsuccessful lessens in class , 
because of failure of teacher to- 
present lessons which are applicable 
to th-e nee'ds of the students 



A 



presenta- 



tion l>^ause of 'MLures 
> reMtea to teaching^ 
metnMplogy 



9 



ABCB 

Improper^son'^lN;ese|ta- 
tion bcs^ause of fai 
lesso^^preparation 



Figure 10. Continued. 
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ABBCA 

Poor cla^ord^cipline 

pro'&e comfortableypliysical 
surroiStdings 




ABBCBA 
Failure of 
to keep 
recep 

of pee^essure 



leaders 

41ed '^nd 
luse 



ABBC , ' 
Failure bf studentjs 
to listen to lessCti 
because of poor 
cla.s.sroom discipline- 



A;' 



ABBGB 
Pool 
bec£ 
rooi! 



classroom discipline • 
use of failure of class- 
leaders to keep class 
contlrolled and, receptive to 
lesEon 



A 



ABBCBB 
Failure of 
keep class c 
to lesson 
interest in 



ABBCC 
' Poor'classroo' 

because of 
^ to adapt 

the studen 




eaders to 
receptive 




ABBCBC 
Failure of 
to keep cl 
receptl 
apparent 
or support 




Figure 10. Continued, 



AD 



ADA 



Hi successful J:estinioiy 
lee tings because of ' 
poor student attendahce 



Lack of opportunities . . 
for st)iritual expuriences 
because of unsuccussM" ■ 
testimony meetingii ■ '; ;„ 



■'A 



ADB 

Unsuccessf, 
meeting 
in 

'do no 



. I ■ ' :. 



■.'ADC' 




failure ^ becaise' of. 'failure, of EtudGtitj j i:.,;, , 

jj^g, ' ■lead^ts coMu'cting ieetlRj^^ ••; t ',' •, 

. ■, , set;lhe.'.pi;oper-rapport;aiid''' 

■*' , ■ ; spir itual filiate ' 

^ ■ iestinignies caji'be 'bo# i^";. ' 



AEA 



Failures related 
to reading 
"tkause of 
ailure to' 
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